From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E2216C433E0 for ; Tue, 16 Feb 2021 18:26:45 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 8002064E04 for ; Tue, 16 Feb 2021 18:26:45 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 8002064E04 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=suse.de Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id EC2868D0001; Tue, 16 Feb 2021 13:26:44 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id E72186B006E; Tue, 16 Feb 2021 13:26:44 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D87528D0001; Tue, 16 Feb 2021 13:26:44 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0096.hostedemail.com [216.40.44.96]) by kanga.kvack.org (Postfix) with ESMTP id C18B16B006C for ; Tue, 16 Feb 2021 13:26:44 -0500 (EST) Received: from smtpin04.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 7FD4F18022295 for ; Tue, 16 Feb 2021 18:26:44 +0000 (UTC) X-FDA: 77824961928.04.scale93_5a129db27646 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin04.hostedemail.com (Postfix) with ESMTP id 65B69800518D for ; Tue, 16 Feb 2021 18:26:44 +0000 (UTC) X-HE-Tag: scale93_5a129db27646 X-Filterd-Recvd-Size: 3590 Received: from mx2.suse.de (mx2.suse.de [195.135.220.15]) by imf18.hostedemail.com (Postfix) with ESMTP for ; Tue, 16 Feb 2021 18:26:43 +0000 (UTC) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 679B9AB4C; Tue, 16 Feb 2021 18:26:42 +0000 (UTC) Date: Tue, 16 Feb 2021 19:26:40 +0100 From: Joerg Roedel To: Paolo Bonzini Cc: Peter Zijlstra , Andi Kleen , David Rientjes , Borislav Petkov , Andy Lutomirski , Sean Christopherson , Andrew Morton , "Kirill A. Shutemov" , Brijesh Singh , Tom Lendacky , Jon Grimm , Thomas Gleixner , Christoph Hellwig , Ingo Molnar , x86@kernel.org, linux-mm@kvack.org Subject: Re: AMD SEV-SNP/Intel TDX: validation of memory pages Message-ID: <20210216182640.GI12716@suse.de> References: <20210212152813.GA28884@suse.de> <20210212161849.GB28884@suse.de> <20210216100045.GE28884@suse.de> <20210216142741.GI365765@tassilo.jf.intel.com> <5ff9690f-331a-8322-3431-212b14f64fcc@redhat.com> <20210216162504.GH12716@suse.de> <92003e9a-c532-bede-1200-ef3b8f50bc6e@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <92003e9a-c532-bede-1200-ef3b8f50bc6e@redhat.com> User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Feb 16, 2021 at 05:48:29PM +0100, Paolo Bonzini wrote: > We should minimize the number of #VEs that we get, as they are very slow. > Could almost everything that can invoke a #VE go through pvops and be turned > into a TDCALL? And if so the same should be true for SEV-ES #VC as well. The problem with that is that it requires the guest to know what the hypervisor will intercept or what instruction will cause a #VE. I considered this paravirtualization for #VC, but stayed away from it for that exact reason. You can't easily know which MMIO-access will cause a #VE/#VC exception. Probing also doesn't work, as the Hypervisor can change that at runtime. There is just no decent way to handle that without taking the #VE/#VC. Or take 'hlt' for example, there are hypervisor configurations which don't intercept it. How do you know that from within the guest? > > I guess those could all be replaced direct TDCALLs, > > but the question remains whether this is possible with MSR accesses, means > > that the list of MSRs which will cause #VEs is statically defined and > > doesn't change between hypervisors. All in all this sounds hard to > > maintain and easy to break by unrelated changes. > > I would expect that all MSRs except for a handful (SPEC_CTRL/PRED_CMD, the > FS/GS/kernelGS bases, anything else?) would be redirect to TDCALL. You never know which HV your guest runs under and what it intercepts. It can certainly be made part of the Spec to only allow direct access to a given set of MSRs in a TDX guest and require to intercept everything else. But that Spec probably requires constant updating and will certainly cause compatibility headaches in the future. Regards, Joerg